feat: add hardened module

hardware/base.nix

@@ -14,7 +14,6 @@
   boot.supportedFilesystems = [ "ntfs" ];
   boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.loader.systemd-boot.enable = true;
-  boot.loader.systemd-boot.editor = false;
   boot.loader.efi.canTouchEfiVariables = true;
 
   services.smartd.enable = true;

system/default.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./hardened.nix
     ./i18n.nix
     ./nix.nix
     ./vpn.nix

system/hardened.nix

@@ -0,0 +1,24 @@
+{ config, pkgs, lib, ... }:
+
+# utilises some of the measures from
+# <nixpkgs/nixos/modules/profiles/hardened.nix>
+with lib;
+{
+  boot.loader.systemd-boot.editor = mkDefault false;
+
+  nix.allowedUsers = mkDefault [ "@users" ];
+
+  # causes Firefox & Tor Browser segfaults
+  # environment.memoryAllocator.provider = mkDefault "scudo";
+  # environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";
+
+  # mullvad-daemon is blocked by one of these measures
+
+  # security.hideProcessInformation = mkDefault true;
+
+  # security.lockKernelModules = mkDefault true;
+
+  # security.protectKernelImage = mkDefault true;
+
+  security.apparmor.enable = mkDefault true;
+}